registry / fjall / 2.29.0

fjall@2.29.0

Fjall CLI

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `fjall agent install-hooks`

Impact

Future Claude Code/Codex sessions invoke `fjall status --agent --budget minimal`, which injects Fjall ambient context.

Mechanism

Explicit AI-agent session-hook installation

Rationale

Source inspection found no concrete malicious chain or lifecycle abuse, but explicit installation of session hooks into AI-agent configuration is a dangerous capability that merits a warning under the firewall policy.

Evidence

package.jsonbin/fjall.jsbin/fjall.bundle.jsbin/assets/generators/organisation/generator.js~/.claude/settings.json~/.codex/hooks.json~/.fjall/hook-opt-out

Network endpoints1

fjall.io

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

`bin/fjall.bundle.js` exposes `fjall agent install-hooks`, an explicit command that writes agent session-hook configuration.
The hook command is `fjall status --agent --budget minimal`, so it executes on later Claude Code/Codex sessions.
The installer writes marked entries to `~/.claude/settings.json` and `~/.codex/hooks.json`.

Evidence against

`package.json` has no preinstall, install, or postinstall lifecycle hook.
`bin/fjall.js` only imports the bundled CLI when the user invokes `fjall`.
Hook installation is user-invoked and uses a package-specific `fjall-agent-session-hook` marker; uninstall removes only that marker.
No credential harvesting or unapproved external exfiltration path was confirmed; the configured API base is package-aligned `https://fjall.io`.
Scanner-reported `Function` use in generator assets is bundled EJS template compilation, not a hidden payload loader.

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystem

Source & flagged code

5 flagged

bin/assets/generators/organisation/generator.jsView file

Lines 1-35javascript

1import { createRequire as __fjcreateRequire } from "module";

2const require = __fjcreateRequire(import.meta.url);

4var Ev=Object.defineProperty;var ve=(e,r)=>{for(var n in r)Ev(e,n,{get:r[n],enumerable:!0})};import{join as CE}from"path";import li from"node:fs"

5 "&": "&"

6 , "<": "<"

7 , ">": ">"

8 , '"': """

9 , "'": "'"

10 }

11 , _MATCH_HTML = /[&<>'"]/g;

12function encode_char(c) {

13 return _ENCODE_HTML_RULES[c] || c;

14};

15`;ee.escapeXML=function(e){return e==null?"":String(e).replace(Iv,Tv)};function pd(){return Function.prototype.toString.call(this)+`;

16`+Nv}try{typeof Object.defineProperty=="function"?Object.defineProperty(ee.escapeXML,"toString",{value:pd}):ee.escapeXML.toString=pd}catch{console.warn("Unable to set escapeXML.toString (is the Function prototype frozen?)")}ee.shallowCopy=function(e,r){if(r

17`),a=Math.max(i-3,0),c=Math.min(o.length,i+3),d=t(n),u=o.slice(a,c).map(function(m,g){let v=g+a+1;return(v==i?" >> ":" ")+v+"| "+m}).join(`

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

bin/assets/generators/organisation/generator.jsView on unpkg · L15

Low

Eval

Package source references a known benign dynamic code generation pattern.

bin/assets/generators/organisation/generator.jsView on unpkg · L15

18`);throw e.path=d,e.message=(d||"ejs")+":"+i+`

19`+u+`

21`+e.message,e}function hd(e){return e.replace(/;(\s*$)/,"$1")}k.compile=function(r,n){let i;return n&&n.scope&&(console.warn("`scope` option is deprecated and will be removed in future EJS"),n.context||(n.context=n.scope),delete n.scope),i=new j(r,n),i.compile()};k.render=function(e,r,n){let i=r||w.createNullProtoObjWherePossible(),t=n||w.createNullProtoObjWherePossible();return arguments.length==2&&w.shallowCopyFromList(t,i,bd),Bt(t,e)(i)};k.renderFile=function(){let e=Array.prototype.slice.call(arguments),r=e.shift(),n,i={filename:r},t,o;return typeof arguments[arguments.length-1]=="function ...

22 function __append(s) { if (s !== undefined && s !== null) __output += s }

23`,n.outputFunctionName){if(!ui.test(n.outputFunctionName))throw new Error("outputFunctionName is not a valid JS identifier.");i+=` ${Gr} `+n.outputFunctionName+` = __append;

24`}if(n.localsName&&!ui.test(n.localsName))throw new Error("localsName is not a valid JS identifier.");if(n.destructuredLocals&&n.destructuredLocals.length){let u=` ${Gr} __locals = (`+n.localsName+` || {}),

25`;for(let m=0;m<n.destructuredLocals.length;m++){let g=n.destructuredLocals[m];if(!ui.test(g))throw new Error("destructuredLocals["+m+"] is not a valid JS identifier.");m

26 `),u+=g+" = __locals."+g}i+=u+`;

27`}n._with!==!1&&(i+=" with ("+n.localsName+` || {}) {

28`,t+=` }

29`),t+=` return __output;

30`,this.source=i+this.source+t}n.compileDebug?e=`${Gr} __line = 1

31 , __lines = `+JSON.stringify(this.templateText)+`

32 , __filename = `+c+`;

33try {

34`+this.source+`} catch (e) {

35 rethrow(e, __lines, __filename, __line, escapeFn);

Long lines were clipped for display.

bin/fjall.bundle.jsView file

•path = bin/fjall.bundle.js kind = oversized_source_file sizeBytes = 3714864 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

bin/fjall.bundle.jsView on unpkg

•path = bin/fjall.bundle.js kind = oversized_cli_entrypoint sizeBytes = 3714864 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

bin/fjall.bundle.jsView on unpkg

bin/assets/generators/application/generator.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = fjall@2.22.1 matchedIdentity = npm:ZmphbGw:2.22.1 similarity = 0.647 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/assets/generators/application/generator.jsView on unpkg

Source & flagged code

5 flagged · loading source

bin/assets/generators/organisation/generator.jsView file

15`;ee.escapeXML=function(e){return e==null?"":String(e).replace(Iv,Tv)};function pd(){return Function.prototype.toString.call(this)+`; L16: `+Nv}try{typeof Object.defineProperty=="function"?Object.defineProperty(ee.escapeXML,"toString",{value:pd}):ee.escapeXML.toString=pd}catch{console.warn("Unable to set escapeXML.toS... L17: `),a=Math.max(i-3,0),c=Math.min(o.length,i+3),d=t(n),u=o.slice(a,c).map(function(m,g){let v=g+a+1;return(v==i?" >> ":" ")+v+"| "+m}).join(` ... L42: `,u.message+=`If the above error is not helpful, you may want to try EJS-Lint: L43: `,u.message+="https://github.com/RyanZim/EJS-Lint",n.async||(u.message+=` L44: `,u.message+="Or, if you meant to create an async function, pass `async: true` as an option.")),u}let d=function(m){let g=function(_,A){let U=w.shallowC

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

bin/assets/generators/organisation/generator.jsView on unpkg · L15

Low

Eval

Package source references a known benign dynamic code generation pattern.

Findings

1 Critical2 High5 Medium6 Low

CriticalPrevious Version Dangerous Deltabin/assets/generators/application/generator.js

HighObfuscated Payload Loaderbin/assets/generators/organisation/generator.js

HighOversized Source Filebin/fjall.bundle.js

MediumDynamic Require

MediumEnvironment Vars

MediumProtestware

MediumOversized Cli Entrypointbin/fjall.bundle.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalbin/assets/generators/organisation/generator.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License